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THIS DATA PROCESSING ADDENDUM is made on the date of the Agreement. 
BETWEEN 


1) GLOBAL MEDIA GROUP SERVICES LIMITED a company incorporated in England and 
Wales under Company Number 03296557 and with its registered office at 30 
Leicester Square, London, WC2H 7LA] ("Global"); and 


2) The party defined as “Advertiser” under the Agreement ("Advertiser"). 


RECITALS 


(A) Global and Advertiser entered into an Agreement under which Global will deliver 
audio measurement to Advertiser ("Agreement"). 


(B) Global and Advertiser have agreed to enter into this data processing addendum 
(“Addendum”) to ensure that adequate safeguards are put in place with respect to 
the protection of Personal Data processed under the Agreement as required by Data 
Protection Laws. 


1. Definitions 
1.1. The following expressions are used in this Addendum: 


"Adequate Country" means a country or territory that is recognised under Data 
Protection Laws as providing adequate protection for personal data; 


"Complaint" means a complaint or request relating to either party's obligations 
under Data Protection Laws relevant to this Agreement, including any compensation 
claim from a Data Subject or any notice, investigation or other action from a 
Supervisory Authority; 


"Data Protection Laws" means the UK Data Protection Legislation and any other 
applicable data protection and privacy legislation and regulatory requirements in 
force from time to time; 
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"Data Subject Request" is as defined in clause 3.1(h); 
"GDPR" means the General Data Protection Regulation ((EU) 2016/679); 


“Global Services” means the services to be provided by Global under the 
Agreement; 


"Personal Data" means all data which is defined as "Personal Data" in the Data 
Protection Laws and which is processed by Global in connection with the 
Agreement; 


"Personal Data Breach" means the accidental or unlawful destruction, loss, 
alteration, unauthorised disclosure of, or access to, any Personal Data; 


"processing", "Data Controller", "Data Subject", "Supervisory Authority" and "Data 
Processor" shall have the meanings ascribed to them in the Data Protection Laws; 


"Sub-Processor" means a Data Processor which is or might be engaged by Global; 


"UK Data Protection Laws" means all applicable data protection and privacy 
legislation in force from time to time in the UK including the UK GDPR; the Data 
Protection Act 2018; the Privacy and Electronic Communications Regulations 2003 
(as amended); and the regulatory requirements of the ICO; and 


“UK GDPR” means the GDPR as retained in UK law pursuant to the European Union 
(Withdrawal) Act 2018. 


1.2. The words "include" and "including" shall not be interpreted as limiting the 
generality of any foregoing words. 


2. Status of the parties 


2.1. The parties hereby acknowledge and agree that Advertiser is the Data Controller and 
Global is the Data Processor. Accordingly Global agrees that it shall process all Personal 
Data in accordance with its obligations pursuant to this Addendum. 


2.2. Each party shall comply with all Data Protection Laws in connection with the processing 
of Personal Data and the exercise and performance of its rights and obligations under 
this Addendum and the Agreement. 


2.3. The type of Personal Data to be processed by Global pursuant to this Addendum and 
the duration, nature and purpose of the processing, and the categories of data 
subjects, are as described in Exhibit A, and shall include other such processing as agreed 
between the parties in writing from time to time. 


3. Data Processor obligations 


3.1. In relation to any Personal Data processed by or on behalf of Global in the provision of 
the Global Services, Global shall: 
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(a) only process the Personal Data in order to provide the Global Services and shall act 
only in accordance with the Agreement, this Addendum and on the instruction of 
Advertiser ("Processing Instructions" and as may be further defined in Exhibit A). 
In the event that Data Protection Laws require Global to process Personal Data 
other than pursuant to Advertiser's instruction, Global will notify Advertiser before 
processing such Personal Data (unless prohibited from so doing by Data Protection 
Laws on important grounds of public interest); 


(b 


<~ 


as soon as reasonably practicable inform Advertiser if, in its opinion, an instruction 
of Advertiser infringes Data Protection Laws; 


— 


(c) taking into account the nature of and risks associated with the type of Personal 
Data collected or used in connection with the Global Services, implement and 
maintain appropriate technical and organisational measures in relation to the 


processing of Personal Data by Global: 


(i) | such that the processing will meet the requirements of Data Protection Laws 
and ensure the protection of the rights of Data Subjects; 


(ii) | so as to ensure a level of security in respect of Personal Data processed by it 
is appropriate to the risks that are presented by the processing, in particular 
from accidental or unlawful destruction, loss, alteration, unauthorised 
disclosure of, or access to Personal Data transmitted, stored or otherwise 
processed; and 


(iii) without prejudice to clause 3.1(h), insofar as is possible, to assist Advertiser 
in the fulfilment of Advertiser's obligations to respond to Data Subject 
Requests relating to Personal Data. 


(d 


~— 


not engage Sub-Processors in respect of the Global Services without Advertiser's 
prior written consent. Global shall remain fully liable to Advertiser for the 
performance of a Sub-Processor's obligations; 


<~ 


(e) without prejudice to any other provision of this Addendum, ensure that Global 
personnel processing Personal Data are reliable and have received adequate 
training on compliance with this Addendum and the Data Protection Laws 


applicable to the processing; 


(f) ensure that all Sub-Processors and Global personnel processing Personal Data are 
subject to a binding written contractual obligation with Global to keep the Personal 
Data confidential (except where disclosure is required in accordance with law, in 
which case Global shall, where practicable and not prohibited by law, notify 
Advertiser of any such requirement before such disclosure); 


— 


provide such information, co-operation and other assistance as Advertiser requires 
(taking into account the nature of processing and the information available to 
Global) to Advertiser in ensuring compliance with Advertiser's obligations under 
Data Protection Laws, including with respect to: 


(g 
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security of processing; 
data impact assessments (as defined by Data Protection Laws); 


(any remedial action and/or notifications to be taken in response to any 
Personal Data Breach and/or Complaint, including (subject in each case to 
Advertiser's prior written authorisation) regarding any notification of the 
Personal Data Breach to Supervisory Authorities and/or communication to 
any affected Data Subjects. 


(h) In relation to requests from Data Subjects: 


(i) 


(ii) 


(iii) 


refer all Data Subject requests for notification, erasure or other requests 
under Data Protection Laws ("Data Subject Requests") it receives to 
Advertiser as soon as reasonably practicable; 


provide such information and cooperation and take such action as Advertiser 
requests in relation to a Data Subject Request, as soon as reasonably 
practicable; and 


not respond to any Data Subject Request or Complaint without Advertiser's 
prior written approval. 


(i) In respect of any Personal Data Breach: 


i) 
(ii) 


(iii) 


(iv) 


(v) 


(vi) 


notify Advertiser of the Personal Data Breach without undue delay; 


provide Advertiser without undue delay with such details as Advertiser 
reasonably requires regarding: 


the nature and cause or possible cause of the Personal Data Breach, 
including the categories and approximate numbers of Data Subjects and 
Personal Data records concerned; 


any investigations into such Personal Data Breach; 


the likely consequences of the Personal Data Breach and the unauthorised 
recipients of the Personal Data; and 


any measures taken, or that Global recommends, to address the Personal 
Data Breach, including to mitigate its possible adverse effects. 


(j) | promptly inform Advertiser if it receives a Complaint and provide Advertiser 
with full details of such Complaint. 


(k) without delay, at Advertiser's written request, either securely delete or securely 
return all the Personal Data to Advertiser in such form as Advertiser reasonably 
requests once processing by Global of any Personal Data is no longer required 
for the purpose of Global's performance of its relevant obligations under this 


Ad 
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dendum and the Agreement, and securely delete existing copies (unless 


storage of any data is required by law and, if so, Global shall inform Advertiser 
of any such requirement). 


4. Data Controller Obligations 
4.1. Advertiser represents, warrants, and covenants: 
(a) it shall provide Personal Data in compliance with Data Protection Laws; 


(b) it shall remove all tracking tags in respect of audio measurement at the date 
of expiry or termination of the Agreement; 


(c) that a user of its services has actively consented to the processing of his or her 
Personal Data; 


(d) all requests for consent shall comply with the requirements under Data 
Protection Laws including that it shall be presented in a manner which is 
clearly distinguishable from other matters, in an intelligible and easily 
accessible form, using clear, and plain language; and 


(e) Advertiser shall have sole responsibility for the accuracy, quality, and legality 
of the Personal Data, and the means by which it acquired Personal Data and 
established consent as the legal basis for processing under Data Protection 
Laws. 


4.2. Advertiser acknowledges and agrees: 


(a) Data Subjects shall have the right, and shall have been informed of the right, 
to withdraw their consent at any time; 


(b) if applicable, it shall inform Global of any rights enforced by Data Subjects 
relevant to the Personal Data processed under the Services, including the 
withdrawal of consent; and 


(c) it will update and notify Global of any modification to any distribution means 
(i.e. player) and provide such information in a manner reasonably acceptable 
to Global. 


5. International Transfers 


Global will not process any Personal Data, pursuant to this Addendum or the Agreement, 
either itself or through any Sub-Processor(s), outside the UK (other than exclusively in the 
European Economic Area or in an Adequate Country), without in each case Advertiser's 
advance consent, which Advertiser may withhold or delay in its discretion, or make subject 
to such additional requirements as it sees fit. 


6. Co-operation and Audits 


6.1. Global shall: 
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(a) allow for and contribute to audits, including inspections, conducted by Advertiser 
or another auditor mandated by Advertiser for the purpose of demonstrating 
compliance by Global with its obligations under Data Protection Laws and this 
Addendum; 


(b 


<~ 


provide (and procure) reasonable access for Advertiser or such other auditor (where 
practicable, during normal business hours) to the facilities, equipment, premises 
and sites on which Personal Data are held, and to any other equipment or facilities 
used in the provision of the Global Services (in each case whether or not owned or 
controlled by Global) and to Global personnel, provided that Advertiser gives Global 
reasonable prior notice of such audit and/or inspection. 


7. Termination 


This Addendum will be effective from the date it is signed by both parties and shall continue 
until expiry or earlier termination of the Agreement. Either party may terminate this 
Addendum immediately on notice to the other party that it is in material breach of this 
Addendum provided however that if the breach is capable of cure, the breaching party will 
have thirty (30) days from the notice date to cure the breach to the non-breaching party's 
reasonable satisfaction. Notwithstanding termination or expiry of this Addendum, any 
provisions of this Addendum that by their nature are intended to survive, will survive 
termination (including the provisions of clause 2.2, 3.1(k), 6 and 8). 


8. General 


8.1. This Addendum is without prejudice to the rights and obligations of the parties under 
the Agreement which shall continue to have full force and effect. In the event of any 
conflict between the terms of this Addendum and the terms of the Agreement, the 
terms of this Addendum shall prevail so far as the subject matter concerns the 
processing of Personal Data. 


8.2. This Addendum sets out all of the terms that have been agreed between the parties in 
relation to the subjects covered by it. Other than in respect of statements made 
fraudulently, no other representations or terms shall apply or form part of this 
Addendum. 


8.3. A person who is not a party to this Addendum shall not have any rights under the 
Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Addendum. 


8.4. This Addendum shall be governed by and construed in accordance with the laws of 
England and Wales and each of the parties agrees to submit to the exclusive jurisdiction 
of the English courts in respect of any claim or matter arising under this Addendum. 


UKMATTERS:45023861.1 


EXHIBIT A 
DATA PROCESSING DETAILS 


A. Duration of the processing: 


The duration of the processing will be until thirteen (13) months from the date on 
which the tracking tags are removed from the Advertiser’s site(s) and/or app(s). 


B. Nature and purpose of the processing: 


Campaign measurement which tracks the engagement and onsite behaviour of a 
user after hearing a DAX digital audio ad. Through DAX’s technology, Advertisers 
are able to: 

e Monitor how campaigns are performing. 

e Track audio exposure to onsite activity. 

e Monitor metrics like impressions and conversion rates. 

e Gain audience insights. 

e Determine which creative strategies are most effective in driving a 

response. 


DAX also uses cross-device technology which helps advertisers understand the 
journey from audio exposure to consideration and action across different devices. 
Advertisers are able to: 
e Identify how many devices were used within the path to purchase; 
e Understand the role of mobile listening in driving desktop calls to action, or 
vice versa; and 
e Learn when distinct browsing and transaction moments occur. 


C. Type of Personal Data: 

IP Address 

User Agent 

Cookie ID 

Device ID 

URL 

Timestamp 
D. Categories of Data Subjects: 

Users of Global Services and Advertiser site(s) and/or app(s). 
E. Processing Instructions 


Reasonable processing instructions given by Advertiser to Global in writing. 


F. Appointed Sub-Processors and Controllers 
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